4 ms·

Could you tell how knowing IBAN enables someone to take money from your account? As far as I understand, the only think that can happen with IBAN is to receive

Could you tell how knowing IBAN enables someone to take money from your account? As far as I understand, the only think that can happen with IBAN is to receive money. Maybe you're thinking of credit card number? The CC's I had had different CC number and IBAN account.

pfg 11y ago
SEPA direct debit allows you to pull money via IBAN (+ BIC, depending on the countries involved in the transaction). Specifics vary from country to country. Some require active approval from the customer (IIRC France, probably more), others "just work". Fraud is not as common, since bank accounts that are allowed to debit money this way are generally only available to companies who have to sign paperwork ensuring that they have written permission from each debitor. Additionally, although this might be country-specific as well, chargebacks can be initiated without providing any reason for at least 8 weeks, and in case of a fraudulent transaction, up to 13 months.
- SimpleMinds 11y ago
  Thanks, didn't know about that. Sounds like it's very specific version of account and most default accounts with IBAN doesn't have this possibility.
  - kuschku 11y ago
    No, anyone’s account can be debited from, but only specific accounts can be debited to. I can’t pull money from your account, even if you tell me your IBAN. But I can use your IBAN to order from amazon, and then amazon can just pull however much they want from your account. Luckily chargeback with direct debit works just as fast as with credit cards.
    - SimpleMinds 11y ago
      Thanks! That's something new that I didn't hear before. For interested parties seems [0] has some information. I need to check with my bank then to see how it works in my country. [0] https://gocardless.com/guides/sepa/introduction/ https://gocardless.com/guides/sepa/introduction/
- _Codemonkeyism 11y ago
  Germany just works.
hvidgaard 11y ago
If you call a bank or another entity, that has your bank information on record, and claim to be someone specific, can answer basic questions and knows the full IBAN - perhaps they believe you are who you claim to be. This is social engineering, and it works.
- SimpleMinds 11y ago
  I think parent specifically mentioned that just IBAN is enough which sounded very unprobable for me. Another comment explained that it's possible but in very specific accounts.

pfg 11y ago

SEPA direct debit allows you to pull money via IBAN (+ BIC, depending on the countries involved in the transaction). Specifics vary from country to country. Some require active approval from the customer (IIRC France, probably more), others "just work". Fraud is not as common, since bank accounts that are allowed to debit money this way are generally only available to companies who have to sign paperwork ensuring that they have written permission from each debitor. Additionally, although this might be country-specific as well, chargebacks can be initiated without providing any reason for at least 8 weeks, and in case of a fraudulent transaction, up to 13 months.

SimpleMinds 11y ago
Thanks, didn't know about that. Sounds like it's very specific version of account and most default accounts with IBAN doesn't have this possibility.
- kuschku 11y ago
  No, anyone’s account can be debited from, but only specific accounts can be debited to. I can’t pull money from your account, even if you tell me your IBAN. But I can use your IBAN to order from amazon, and then amazon can just pull however much they want from your account. Luckily chargeback with direct debit works just as fast as with credit cards.
  - SimpleMinds 11y ago
    Thanks! That's something new that I didn't hear before. For interested parties seems [0] has some information. I need to check with my bank then to see how it works in my country. [0] https://gocardless.com/guides/sepa/introduction/ https://gocardless.com/guides/sepa/introduction/
_Codemonkeyism 11y ago
Germany just works.

hvidgaard 11y ago

If you call a bank or another entity, that has your bank information on record, and claim to be someone specific, can answer basic questions and knows the full IBAN - perhaps they believe you are who you claim to be. This is social engineering, and it works.

SimpleMinds 11y ago
I think parent specifically mentioned that just IBAN is enough which sounded very unprobable for me. Another comment explained that it's possible but in very specific accounts.